Skip to content

(v6.x backport) zlib: fix node crashing on invalid options#13201

Closed
aqrln wants to merge 2 commits intonodejs:v6.x-stagingfrom
aqrln:v6.x-backport-13098
Closed

(v6.x backport) zlib: fix node crashing on invalid options#13201
aqrln wants to merge 2 commits intonodejs:v6.x-stagingfrom
aqrln:v6.x-backport-13098

Conversation

@aqrln
Copy link
Contributor

@aqrln aqrln commented May 24, 2017

This is a partial backport of semver-patch bits of 9e4660b.

This commit fixes the Node process crashing when constructors of classes
of the zlib module are given invalid options.

  • Throw an Error when the zlib library rejects the value of windowBits,
    instead of crashing with an assertion.

  • Treat windowBits and memLevel options consistently with other ones and
    don't crash when non-numeric values are given.

Refs: #13098

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
Affected core subsystem(s)

zlib

@aqrln
zlib: fix node crashing on invalid options
9619966 
This is a partial backport of semver-patch bits of
9e4660b.

This commit fixes the Node process crashing when constructors of classes
of the zlib module are given invalid options.

* Throw an Error when the zlib library rejects the value of windowBits,
  instead of crashing with an assertion.

* Treat windowBits and memLevel options consistently with other ones and
  don't crash when non-numeric values are given.

Refs: nodejs#13098
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. v6.x zlib Issues and PRs related to the zlib subsystem. labels May 24, 2017
@aqrln aqrln changed the title zlib: fix node crashing on invalid options (v6.x backport) zlib: fix node crashing on invalid options May 24, 2017
sam-github
sam-github reviewed May 24, 2017
View reviewed changes
src/node_zlib.cc
ctx->init_done_ = true;

if (ctx->err_ != Z_OK) {
if (dictionary != nullptr) {
Copy link
Contributor

@sam-github sam-github May 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fwiw, you don't need the conditional, the following two lines of code can run correctly whether dictionary is nullptr or not.

Copy link
Contributor Author

@aqrln aqrln May 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, nice. Thanks.

refack
refack approved these changes May 25, 2017
View reviewed changes
Copy link
Contributor

@refack refack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM % small nits

lib/zlib.js Outdated
var memLevel = exports.Z_DEFAULT_MEMLEVEL;
if (typeof opts.memLevel === 'number') memLevel = opts.memLevel;

this._handle.init(windowBits || exports.Z_DEFAULT_WINDOWBITS,
Copy link
Contributor

@refack refack May 25, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If your changing this line anyway, IMHO handle the fallback in 383 (opts.windowBits && typeof...)

lib/zlib.js Outdated
this._handle.init(windowBits || exports.Z_DEFAULT_WINDOWBITS,
level,
opts.memLevel || exports.Z_DEFAULT_MEMLEVEL,
memLevel || exports.Z_DEFAULT_MEMLEVEL,
Copy link
Contributor

@refack refack May 25, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ditto

test/parallel/test-zlib-failed-init.js

// For raw deflate encoding, requests for 256-byte windows are rejected as
// invalid by zlib.
// (http://zlib.net/manual.html#Advanced)
Copy link
Contributor

@refack refack May 25, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change to:
Ref: http://zlib.net/manual.html#Advanced

Dismissed

Copy link
Contributor Author

@aqrln aqrln May 25, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a good idea to change this one since that's how it is already committed to master.

Copy link
Contributor

@refack refack May 25, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack.

refack
refack approved these changes May 25, 2017
View reviewed changes
Copy link
Contributor

@refack refack left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Win! 💯
(appreciated all the branch juggling you did for that)

@aqrln
Copy link
Contributor Author

aqrln commented May 25, 2017

CI: https://ci.nodejs.org/job/node-test-pull-request/8297/

@MylesBorins
Copy link
Contributor

MylesBorins commented May 30, 2017

This can land once we do the next v6.x release

@gibfahn
Copy link
Member

gibfahn commented Jun 17, 2017

CI: https://ci.nodejs.org/job/node-test-commit/10630/

gibfahn pushed a commit to gibfahn/node that referenced this pull request Jun 17, 2017
@aqrln @gibfahn
zlib: fix node crashing on invalid options
321c90f 
This is a partial backport of semver-patch bits of
9e4660b.

This commit fixes the Node process crashing when constructors of classes
of the zlib module are given invalid options.

* Throw an Error when the zlib library rejects the value of windowBits,
  instead of crashing with an assertion.

* Treat windowBits and memLevel options consistently with other ones and
  don't crash when non-numeric values are given.

PR-URL: nodejs#13098
Backport-PR-URL: nodejs#13201
Fixes: nodejs#13082
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
@gibfahn
Copy link
Member

gibfahn commented Jun 17, 2017

Landed in 321c90f

@gibfahn gibfahn closed this Jun 17, 2017
@aqrln aqrln deleted the v6.x-backport-13098 branch June 18, 2017 09:47
gibfahn pushed a commit that referenced this pull request Jun 20, 2017
@aqrln @gibfahn
zlib: fix node crashing on invalid options
8250c43 
This is a partial backport of semver-patch bits of
9e4660b.

This commit fixes the Node process crashing when constructors of classes
of the zlib module are given invalid options.

* Throw an Error when the zlib library rejects the value of windowBits,
  instead of crashing with an assertion.

* Treat windowBits and memLevel options consistently with other ones and
  don't crash when non-numeric values are given.

PR-URL: #13098
Backport-PR-URL: #13201
Fixes: #13082
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
MylesBorins pushed a commit that referenced this pull request Jul 11, 2017
@aqrln @MylesBorins
zlib: fix node crashing on invalid options
55cbe24 
This is a partial backport of semver-patch bits of
9e4660b.

This commit fixes the Node process crashing when constructors of classes
of the zlib module are given invalid options.

* Throw an Error when the zlib library rejects the value of windowBits,
  instead of crashing with an assertion.

* Treat windowBits and memLevel options consistently with other ones and
  don't crash when non-numeric values are given.

PR-URL: #13098
Backport-PR-URL: #13201
Fixes: #13082
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
@addaleax addaleax mentioned this pull request Aug 7, 2017
Closed
@addaleax
Copy link
Member

addaleax commented Aug 7, 2017

This should probably be released together with #14666

@aqrln aqrln mentioned this pull request Aug 16, 2017
Closed
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes

@lpinca lpinca lpinca approved these changes

+2 more reviewers

@sam-github sam-github sam-github approved these changes

@refack refack refack approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. zlib Issues and PRs related to the zlib subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@aqrln @MylesBorins @gibfahn @addaleax @sam-github @refack @jasnell @lpinca @nodejs-github-bot